R4Mbb

A race condition exists where an app may be able to access sensitive user data. A race condition is a situation where the system's substantive behavior is dependent on the sequence or timing of other uncontrollable events.

An application may be able to access user-sensitive data due to improper handling of symlinks (symbolic links), which are files that point to another file or directory on the system.

Insufficient input sanitization and output escaping in the `gdrts live handler` AJAX function allow unauthenticated attackers to perform Stored Cross-Site Scripting. By manipulating the `title` and `url` render arguments, an attacker can inject arbitrary web scripts into pages. These scripts execute when a user accesses the affected page. Although the AJAX action requires a per-item nonce (a unique token used to prevent replay attacks), this token is publicly exposed in the JSON block of the page, allowing any visitor to obtain it.

An issue exists where authenticated attackers with subscriber-level access or higher can perform blind SQL Injection. This occurs due to insufficient escaping of user-supplied parameters and a lack of proper preparation of the SQL query. The attack requires a form to be configured with a database-backed dynamic choice field using a WHERE template that references the `{username}` placeholder. An attacker can set their `display name` to a SQL payload via the WordPress profile edit screen and then trigger the `fm reload input` AJAX endpoint to append malicious queries and extract sensitive information from the database.

The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress contains a Stored Cross-Site Scripting issue in the admin settings. This occurs due to insufficient input sanitization and output escaping, allowing authenticated attackers with editor-level permissions or higher to inject arbitrary web scripts into pages. These scripts execute when a user accesses the affected page. This issue specifically impacts multi-site installations and environments where `unfiltered html` has been disabled. The flaw is triggered via the `fonts[].font.font.value` parameter.

Improper Privilege Management allows local .htaccess authors to read files using the privileges of the httpd user.

The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject malicious scripts into the website, potentially affecting users who access the compromised page.